Hole in Webkit software used in browsers affects mobile and desktops but is more easily exploited on smartphones where security is limited, researcher says.